Re: Encrypting password

[Richard Seymour]

> If you are using SSL then why even bother hashing the password?


The one reason I can think of hashing a password even if you have SSL is
because then the password stored on the server must also be hashed to be
useful. It is better to *not* store passwrods on the server in plain
text, since if your server is compromised the passwords aren't useful. 

However, if that's the point, then you can probably get by with sending
the password in clear text (over SSL, so it's unsniffable) and hash it
on the server.


-- 
Richard Seymour : Anarchy Software, Inc.
- * - - * - - - * -+- * - - - * - - * -
      `°º¤ø,¸             ¸,ø¤º°'
             `°º¤ø,¸¸,ø¤º°

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, email: [EMAIL PROTECTED]